What is the "csrss.exe" process on windows 7? Is the "csrss.exe" process a virus? Can I terminate the "csrss.exe" process?

"csrss.exe" process represents "Client Server Runtime Process" program. "csrss.exe" is responsible for Win32 console handling and GUI shutdown of Windows 7 operating system.

"csrss.exe" process is normally running under the parent process "System" as shown in the process tree below:

Boot
   csrss

On the Processes tab of "Task Manager", 2 "csrss.exe" processes may be listed: one to help background processes like services, and one to help foreground processes like winlogon.exe and your applications.

Image Name                 Memory   Description
--------------------   ----------   -----------
csrss.exe                 2,224 K   Client Server Runtime Process
csrss.exe                 5,528 K   Client Server Runtime Process

Additional information about "csrss.exe" process:

Command line:
   Windows\system32\csrss.exe ObjectDirectory=\Windows 
   SharedSection=1024,12288,512 Windows=On SubSystemType=Windows 
   ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 
   ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 
   ProfileControl=Off MaxRequestThreads=16

Programe file information:
   Name: csrss.exe
   Location: C:\windows\system32\csrss.exe
   Description: Client Server Runtime Process
   Version: 6.1.7600.16385 (win7_rtm.090713-1255)
   Size: 7680 bytes
   Last modified: 7/13/2009 9:39:02 PM
   Company Name: Microsoft Corporation

Some data files used:
C:\Windows\System32
C:\Windows\System32\en-US\csrss.exe.mui
C:\Windows\System32\en-US\winsrv.dll.mui
C:\Windows\System32
C:\Windows\System32\en-US\winsrv.dll.mui
C:\Windows\System32\en-US\sxs.dll.mui
C:\Windows\System32\en-US\KernelBase.dll.mui

Some registry keys used:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
HKLM\SYSTEM\ControlSet001\Control\SESSION MANAGER
HKLM\SYSTEM\ControlSet001\Control\PriorityControl
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
HKLM\SYSTEM\ControlSet001\Control\SESSION MANAGER
HKCU\Control Panel\International
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide

Some DLL libraries used:
C:\windows\SYSTEM32\ntdll.dll
C:\windows\system32\CSRSRV.dll
C:\windows\system32\basesrv.DLL
C:\windows\system32\winsrv.DLL
C:\windows\system32\USER32.dll
C:\windows\system32\GDI32.dll
C:\windows\SYSTEM32\kernel32.dll
C:\windows\system32\KERNELBASE.dll
C:\windows\system32\LPK.dll
C:\windows\system32\USP10.dll

"csrss.exe" process is not a virus. You should not terminate "csrss.exe" process.

⇒ "wininit.exe" Process on Windows 7

⇐ "smss.exe" Process on Windows 7

⇑ System Processes on Windows 7

⇑⇑ Windows 7 Processes Tutorials